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An important metric of the performance of a quantum secret sharing scheme is its information rate. Beyond 
the fact that the information rate is upper bounded by one, very little is known in terms of bounds on the 
information rate of quantum secret sharing schemes. Further, not every scheme can be realized with rate one. In 
this paper we derive new upper bounds for the information rates of quantum secret sharing schemes. We show 
that there exist quantum access structures on n players for which the information rate cannot be better than 
0((log2 n)/n). These results are the quantum analogues of the bounds for classical secret sharing schemes 
proved by Csirmaz. 
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I. INTRODUCTION 

Quantum secret sharing is a cryptographic protocol to dis- 
tribute a secret state (either classical or quantum) among a 
group of players P, such that only authorized subsets of P can 
reconstruct the secret state from the distributed quantum states 
l^iM- The quantum state distributed to each party is called a 
share. The collection of authorized sets is called the access 
structure of the scheme. Two important problems related to 
quantum secret sharing are the construction of efficient secret 
sharing schemes for various access structures ylQ] and estab- 
lishing the bounds on the efficiency of secret sharing schemes 
yl la] . Despite the rapid growth of the field since its incep- 
tion in lit], see for instance ll2l- [l3ll and the references therein, 
bounds on the efficiency of quantum secret sharing schemes 
are hard to come by. The main purpose of this paper is to 
report some progress on this problem. 

The efficiency of a quantum secret sharing scheme is quan- 
tified by its information rate. Informally, this is defined as the 
ratio of the size of the secret to the size of the largest share, (a 
precise definition will be given later). The importance of the 
information rate can be understood as follows. Smaller the 
rate, larger are the sizes of the shares and the overhead costs 
of storage and communication. As the shares are to be kept se- 
cret, the security of the protocol can be undermined by large 
shares. For these reasons it is beneficial to design schemes 
with high information rate. 

A secret sharing scheme is said to be perfect if unauthorized 
sets cannot extract any information about the secret. In such 
schemes the size of the share must be at least the size of the se- 
cret iIj, la] . Therefore the information rate of perfect quantum 
secret sharing schemes is upper bounded by one. Given an 
access structure it is not always possible to construct schemes 
which realize the access structure with information rate one. 
Therefore, we would like to know bounds on the sizes of the 
shares for a given access structure. Both Gottesman i3\ and 
Smith ]i4J] have given constructions for general access struc- 
tures. These constructions provide implicitly lower bounds 
for the information rate of quantum secret sharing schemes. 
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In these constructions, the size of a share can be exponentially 
larger than the size of the secret. 

At the other end we could ask what is the minimum size of 
share "required" to implement an access structure on n partic- 
ipants. This question is difficult to answer unless we impose 
some restrictions on the access structures. We study the in- 
formation rate of a specific type of access structures and show 
that for these the size of a share must be at least 0{n/ log2 n) 
larger than the size of the secret. These results are quantum 
analogues of the bounds for classical secret sharing schemes 
proved by Csirmaz ltl4ll . 

In this paper we restrict our attention to perfect quantum 
secret sharing schemes where the secret is a quantum state. 
Bounds on quantum secret sharing schemes which share a 
classical secret are not dealt with in this paper. 



A. Background 

In this section we will briefly review some of the necessary 
background and notation used in the paper. We denote the par- 
ticipants of a secret sharing scheme by P, typically assumed 
to be the set P = {1,2,..., n}. The access structure of a se- 
cret sharing is denoted by T. A special type of authorized set 
is one whose proper subsets are unauthorized. The collection 
of minimal authorized sets of an access structure F is denoted 
as Fniin. The notation 2^ is for the collection of all subsets of 
P. We denote the complement of A C P by ^ = P \ A. An 
access structure is said to be monotone if and only if for any 
A e r, any set containing A is also in F. Given F we define 
the dual access structure as F* = {A \ A ^ F}. An access 
structure is said to be self-dual if F = F*. 

An access structure that can be realized by quantum secret 
sharing schemes is called a q uantum access structure. Due 
to the no-cloning theorem lUSlllql , quantum access structures 
satisfy the following requirements: 

Fact 1 (]|20). In a quantum access structure, the complement 
of an authorized set is unauthorized. 

Fact 2 (i^). An access structure is a quantum access struc- 
ture if and only if it is monotone and no two authorized sets 
are disjoint. 



Our analysis of quantum secret sharing schemes is infor- 
mation theoretic. Therefore, we quickly recall some of the 
relevant notions of quantum information. Given a density ma- 
trix p we denote its von Neumann entropy as S{p) which is 
defined as 



5(p) = ~Tr(plog2p). 



(1) 



Sometimes we have to find the entropy of a set of quantum 
systems indexed by a set A. In such situations, we denote the 
von Neumann entropy of a system A as S{A) where 

S{A)^~T,{pA\og.,pA), (2) 

and PA is the (reduced) density matrix of A. In this paper 
unless otherwise specified entropy refers to the von Neumann 
entropy. The mutual information between two systems A and 
B is denoted by /(A : B) and 

I{A:B)=S{A) + S{B)-S{A,B). (3) 

A very useful inequality relating the entropy of three systems 
A, B, C is the strong subadditivity inequality: 



S{A, C) + SiB, C) > S{A, B, C) + S{C). 



(4) 



A slightly different statement of the above inequality will be 
useful to us. Because we can associate the arguments of S{-) 
to an index set V, we can also regard entropy as a set function 
i.e. S" : 2^ ^- M. Then it becomes clear that entropy is a 
submodular function, in other words, it satisfies 



S(X) + S{Y) > S{X UY) + S{X n Y). 



(5) 



To show this letC = XnY, A = X\C eind B ^Y\C. 
Then substituting for A, B,C in equation (HJi we obtain S{X \ 

{X nY),xnY) + s{Y \(xnY),xnY)> s{x \{xn 

Y),Y\{X nY),X (lY) + S(X n Y) which simpHfies to 
equation (|5]i. 

An information theoretic model for quantum secret sharing 
schemes was proposed in la]. As we make significant use of 
this framework to prove our results we provide a brief review 
of this model. 

We denote the Hilbert space of a system A by Ha- Let S 
be the secret to be distributed and let "Hs be the associated 
Hilbert space. We assume that ps = J2i£W Q!i|*)(i|- The 
secret is purified using a reference system R to give a pure 
state \RS). Then 

S{R) = S{S) (6) 

Assume that the set of players is given by P = {1, . . . , n}. A 
distribution of shares for the quantum secret sharing scheme 
is defined to be a completely positive trace preserving map A 

A:nRs~^nB.®np, (?) 

such that for every authorized set ^4 C P there exists a re- 
covery map Ir (g) TZa ■ Hr ® Ha -^ Hrs that maps 
Pra '-^ \RS){RS\. The information rate of the quantum se- 
cret sharing scheme is defined as 

« = ^^. m 

The information theoretic model provides the following 
characterization of quantum secret sharing schemes ^ : 



Lemma 1. In a perfect quantum secret sharing scheme with 
access structure V we must have 

I{A: R) = I{A: S) = 2S{S)forallAer (9) 
I{A: R) ^ I{A: S) = OforallA<^T (10) 

The first condition has been called the recoverability re- 
quirement while the second has been termed secrecy require- 
ment. We also need the following lemma, although an imme- 
diate consequence of Lemma [T] we include it for complete- 
ness. 

Lemma 2. Let A eT. Then we have the following relations. 

SiA)^^I{A:A) + SiS) (11) 

1 



SiA) = -/(A : A) 



(12) 

S{A) - S{A) ^ S{S) (13) 

Proof If A gT, then A ^ T. Computing I{A : A) we obtain 

I{A:A)=SiA) + SiA)-SiA,A) (14) 

^S{A) + S{A)-S{R) (15) 

= S{A) + S{A,R)-S{S) 
= S{A) + S{A) + S{R) - I{A : R) - S{S) 
= 2S{A) - 2S{S), 

which gives us the first relation. Substituting for S{A) in 
equation (fl4] i gives us the second relation. 

I{A : A) = I{A : A)/2 + S{S) + S{A) - S{S) 

The last relation is immediate from the previous two equa- 
tions, n 

II. BOUNDS ON THE INFORMATION RATE 

In this section we derive lower bounds on the size of shares 
(in terms of the von Neumann entropy) and thus compute up- 
per bounds on the information rate. The main result of this 
section is a lower bound on the size of shares for a class of ac- 
cess structures. A similar result was shown for classical secret 
sharing schemes by Csirmaz 11 1411 . 

Lemma 3. Given a perfect quantum secret sharing scheme 
with access structure T, for any A C P, one of the following 
must hold: 

S{A,R)^S{A)-S{S)ifAeT (16) 

S{A,R)^S{A) + S{S)ifA<^T (17) 

Proof For any subset A, using the definition of mutual infor- 
mation in equation ([3]) 

S{A, R) = S{A) + S{R) - I{A : R) 

S{A,R) = S{A) + S{S)-I{A:R), (18) 

where we have used equation (|6]l in the last step. By Lemma[T] 
we know that I{A : R) = 2S{S) ifAeT and I{A : R) = 
otherwise. Substituting these values in equation (flSl l we get 
the stated result. D 



Lemma 4. Let A, B be any two authorized sets such that A n 
B is not authorized. Then we have the following inequality: 

S{A) + S{B) > S{A \JB) + S{A n B) + 2S{S). (19) 

Proof. By using Lemma|3] we can write S{A) + S{B) as 

S{A) + S{B) = S{A UR) + S{B U R) + 2S{S) 

>S{AUBUR) + S{{A r\B)UR) + 2S{S) 

where we used the subadditivity inequaUty in the last equa- 
tion. Once again using Lemma[3]and simplifying, we obtain 

S{A) + S{B) > S{A UB) + S{{A n B)) + 2S{S) 

as stated. D 

A. The General Case with n Parties 

Definition (Csirmaz Access Structure). Given an integer n > 
4, let k be the largest integer such that n > 2^^ ~ 2 + k. Let 
A C P be such that \A\ = k. Consider all the 2^ subsets 
of A enumerated in the order of decreasing cardinality. Let 
B = P\A ^ {&!,..., fo„_fc}. Let Bn = %, B^.^^ = B 
and Bj = {6i, . . . ,hi} for Q < i < 2^ - 
minimal access structure given as below: 



2. Let T^2L ^e f/^e 



.(n) 



{AUBj I < i < 2^ -1}. 



(20) 



We emphasize that in these access structures, we have Ai n 
Bj = 0, Ai (/_ Aj if i < j and Bi ^ Bj ifi>j.As an aside 
we note that the access structure defined above departs from 
the one originally proposed by Csirmaz | |14l] in the definition 
of the minimal authorized set i?2fc-2 ^nd secondly, it is always 
connected i.e., every party occurs in some minimal authorized 
set. It is easy to see that this is a minimal access structure. If 
it is not, then for some distinct i,j we must have AiU Bi C 
Aj U Bj, then it follows that A, C A^ and Bi C B^. This 
implies i > j and i < j, which is impossible for i ^ j. 

Lemma 5. The access structure r^j^^, defined in equa- 
tion ( I20l l, is a quantum access structure. 



Proof. The elements of the minimal access structure F^/j^ are 
given by 



Mi = ^i U B, for < i < 2*^ - 1 (21) 

Consider Mi n Mj for any i ^ j. Then because A^ fl -8/ = 
for any k,lwe have 

Mi n Mj = {A, r\Aj)u {Bi nBj). 

Without loss of generality we can assume that i < j. If i = 
0, then Bo = and Aq = yl D Aj for all j. Therefore 
Mo n Mj = Aj 7^ 0. If i 7^ 0, then we have Bi =i 9 and by 
construction Bi C Bj. Thus we have Ali n Mj 1^ Bi ^ id. 

Thus we always have Ali H Mj / 0. Thus by Fact|2l T^^^ is 
a quantum access structure. D 



It turns out that the access structure F*^"^ is not self-dual. 
For instance, the set Ai U B^-i for i > 1 is unauthorized as 
well its complement {A\Ai)U{B\Bi-i) is also unauthorized. 
For a technical reason in the computation of the entropies, it 
is much more convenient to work with self-dual access struc- 
tures. For this reason we need the following notion introduced 
by Gottesman yD . 

Purification of Access Structures: An access structure F 
on a set of players P = {l,2,...,ri} that is not self-dual can 
be "purified" to give a self-dual access structure F on a set of 
players P' = {1, 2, . . . , n, n + 1} by 

i) Adding an additional party, n + 1 . 

ii) Additional authorized sets, created from unauthorized 
sets of original structure and having the following form: 

{AU{n+l}\A^T;P\A^T}. 

The additional authorized sets all contain the party {?i + 1}. 
These sets are created from a pair sets A and P\A such that 
both are not in F, i.e., both are unauthorized. Purification con- 
verts one of them to an authorized set in F along with addi- 
tional party. Thus AU {n+ 1} eThut P\A ^T. 

Remark. It is important to note that all the authorized sets 
of F are also authorized sets of its purification F and all the 
unauthorized sets ofV are unauthorized in F. 

Purification of access structures was introduced by Gottes- 
man in [3]. Purification of access structures is useful in that 
it gives an access structure that has a pure-state secret sharing 
scheme and the scheme for the original access structure can 
be obtained by discarding the share that has been added. We 
recover the original access structure by discarding the share 
associated with {71 + 1}. 

The following theorem closely follows the structure of 11141 
Theorem 3.2, Lemma 3.3-3.4], but note that the results therein 
do not apply in the quantum setting. Firstly, because the 
model of quantum secret sharing schemes is different and 
secondly, despite the similarity of the access structures, the 
proofs in Ill4ll invoke the use a (polymatroidal) function which 
is assumed to be monotonic and submodular. The von Neu- 
mann entropy, as is well-known, does not satisfy the assump- 
tion of monotonicity. 

Theorem 6. LetT be a purification of an access struc- 

ture defined as in equation ( 120b . Then in any realization of 

F there exists some share i for which S{i)/S{S) > 

((2^+i-l)/(2fc + l))=0(n/log2n). 

Proof. We assume that F^"^^^ is defined on P = 

{1,2,. ..,n — 1} and its purification F is defined on 

P' = {1, 2, . . . , n — 1, n} The idea behind the proof is to 
obtain a lower bound on the entropy of a subset of P'. Our 
aim will be to get a lower bound on the entropy of a subset 
A C {l,...,n-l,n} such as S{A) > aS{S). Then using 
the fact that S{A) < S{i)\A\ for some i G P', we can lower 
bound the size of the ith share as aS{S)/\A\. 

Let Xi = BiUA and Y^ = A^+i U -Bj+i. First observe that 
Xi, Yi are both authorized sets as Xi D Mi and Yi D Mi^i. 



Furthermore, XiCiYi = Ai+i U Bi is unauthorized. Suppose 
on the contrary that Xi n Kj is authorized; then for some j we 
must have Mj == Aj U Bj C Ai+i U Bi. Since A; n B„i = 
for all choice of / and -m, this implies that Aj C A^+i and 
Sj C Bi, which can only hold if j > i + 1 and j < i giving 
us a contradiction. Therefore Xi n Yi is unauthorized and we 
can apply Lemma |4] which gives us 

s{x{) + s{Y,) > s{x, u y,) + Six, n r,) + 2SiS). 

This can be rewritten as 

S{A U B,) + S{A,+i U B,+i) > S{A U B,+i) + 2S{S) 

+ S{A,+i[JB,). 

Now we apply submodularity inequality to the sets ^i+i U Bi 
andBj+i: 

5(A,+i U B,) + 5(B,+i) > 5(A,+i U B,+i) + 5(5,). 

Adding the previous two inequalities we obtain 

S{A U B,) + S{B,+i) > SiA U B,+i) + S{B,) + 23(3) 

Clearly, this inequality holds for all < i < 2'' — 2. Adding 
them all up we obtain 

2'=-3 2*^-3 

Y, S{A U BO + S{B,+i) >Y,S{AU B,+i) + 3{B,) 



i=0 



i=0 
■)fc 



+ (2" - 2)23(3) 
3{A U Bo) + 3{B2..2) > S{A U B2.-2) + 5(Bo) 
+ (2'^' - 2)23(3) 

As Bq = 0, this reduces to 

3{A) + 5(B2-o_2) > S{A U B2'«-2) + (2''' - 2)25'(5') 

Since AUi?2fc-2 is authorized its complement is unauthorized 
by Fact[T]and by Lemma|2] 5(AUB2fc-2) = 3(AaJB^^) + 
3(3) > 25(5), where we also used the fact that 3{Z) > 
3(3) for any unauthorized set Z, la Theorem 6], see also |i3|. 
Theorem 4] . Therefore we now have 

5(yl) + 5(B2'=-2)> (2' -1)25(5) 

By Lemma 121 5(B2'=-2) = S(B2k_2) = 3{A,R,n) < 
5(A, R) + 3iR, n) ^3{3) = 3 {A) + 5(n) - 3(3), therefore 
we obtain 

25(A) + 3{n) - 3(3) > [2^ - 1)25(5) 
25(A) + 3{n) > [2^+^ - 1)5(5) 

But 3{A) < X;Li Sii), hence 

A: 

3{n) + J2 2^(*) > (2^+' - 1)5(5). 



Hence for some 1 < i < k ot i — n, we must have 

nfc+l _ 1 

3(i) > — 3(3) 

^ ^ - 2k+l ^ ^ 



Since F*^"^^' has n — 1 participants with n— 1>2'^ + A: — 2, 
we see that some share is at least as large as 0{n/ logj n) the 
size of the secret. D 

Corollary 7. For all n > 4, there exist quantum secret 
sharing schemes with information rate upper bounded by 

0[[\og2n)ln). 

Classically the techniques used to study of bounds on secret 
sharing schemes often rely on information theoretic inequali- 
ties of the Shannon entropy. Furthermore, there is a larger set 
of tools available such as polymatroids that make it possible to 
derive general results. Unfortunately in the study of quantum 
secret sharing schemes, these tools are either difficult to apply 
or either inapplicable. For this reason it is interesting that we 
have been able to use the von Neumann entropic inequalities 
to prove Theorem|6l 



B. Bounds for Special Cases: n = 4, 5 

Often the study of small instances can reveal interesting in- 
sights. For this reason we now consider the access structure 
for n = 4, to derive some slightly tighter bounds than the ones 
obtained in Theorem|6l 

Theorem 8. Any realization of the quantum minimal access 
structure F'^' or its purification must have some share of size 
50% larger than the size of secret. 

rf„i„ = {(l,2);(l,3);(2,3,4)} (22) 

Proof. The purification of T\J^.^ is given by T^^^^ ~ 
{(1, 2); (1, 3); (2, 3, 4); (2, 3,p);p(l, 4,p)}. First we observe 

—(4) 

that Fjjjjjj is a realizable quantum access structure as any two 
authorized sets have a nonempty intersection. Furthermore, it 
can be easily verified that it is also a self-dual access structure. 
Consider now the sets Aq = {1,2,3}, Bq = {2,3,4}. Both 
these sets are authorized sets while Aq D Bq = {2, 3} is not 
authorized. Therefore by LemmaH] we have 

5(l,2,3) + 5(2,3,4) > 5(1,2,3,4) + 5(2,3) + 25(5). 

Consider now the sets Ai = {2, 3} and Bi = {3, 4}. By the 
subadditivity of the von Neumann entropy we obtain 

5(2, 3) + 5(3, 4) > 5(2, 3, 4) + 5(3). (23) 

Adding the previous two inequalities we obtain 

5(1, 2, 3) + 5(3, 4) > 5(1, 2, 3, 4) + 5(3) + 25(5)(24) 
This can be rewritten as 

5(1, 2, 3) - 5(3) > 5(1, 2, 3, 4) - 5(3, 4) + 25(5)(25) 
Consider now the sets A2 = {1,2} and B2 = {1,3} which 

—(4) 

are both in Fj^-^jj-,, while A2 tl B2 = {1} is unauthorized. Ap- 
plying Lemma|4]we obtain 

5(1, 2) + 5(1, 3) > 5(1, 2, 3) + 5(1) + 25(5). (26) 



By the subadditivity inequality we have 

3(1) + 8(3) > 8(1,3). (27) 

Adding the previous two equations we obtain 

5(1, 2) + 5(3) > 5(1, 2, 3) + 25(5), (28) 

which can be rewritten as 

5(1,2) > 5(1, 2, 3) -5(3) + 25(5). (29) 

Now let us add the equations ( |25] |. and ( |29] l to obtain 

5(1, 2) + 5(3, 4) > 5(1, 2, 3, 4) + 45(5). (30) 

By Lemma[3] 5(1, 2, 3, 4) = S{p) + 8(8) > 25(5). Further, 
applying the subadditivity inequality to 5(1,2) and 5(3,4) 
we can reduce the previous equation to 

5(1) + 5(2) + 5(3) + 5(4) > 65(5) (31) 

Finally, the non-negativity of 5() implies at least one of the 
entropies S(i), 1 < i < 4 must be greater than their average 

65(5)/4. Thus at least some share of T'-'^'^ and T must at 
least 50% larger than the size of the secret. D 



1—1 —(4) 

Theorem |6] predicts that T will have an information rate 
of 5/7 ~ 0.714, while the above result shows that it can be at 
most 2/3 « 0.667. 



m. CONCLUSION 

In this paper we investigated the sizes of shares for quan- 
tum secret sharing schemes. We showed that there exist access 
structures, on n participants, for which the size of the share 
grows as 0{n/ log2 n). To the best of our knowledge, these 
bounds represent the strongest lower bounds on the size of 
a share (equivalently upper bounds on the information rate). 
Some questions suggested by these results are the tightness 
of these bounds and the schemes for realizing these access 
structures with information rates close to the bounds. We will 
address these questions elsewhere. We hope that this work 
highlights the fact that there is a significant gap between the 
upper bounds and lower bounds for the information rate of 
(perfect) quantum secret sharing schemes and motivates fur- 
ther research in this direction. 
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